Validate a domain's DNSSEC configuration by checking for DS records at the parent zone, DNSKEY records at the domain, RRSIG signatures, and NSEC/NSEC3 records — returns a full chain-of-trust assessment and readiness score so agents can verify DNS integrity before trusting resolution results.